Allow usernames when using NKey authn

[Kinrany]

Having usernames is convenient as a form of documentation even when that username is not required for identifying the users.

Would it make sense to allow configuring NATS users to have a name even when there is an NKey used to authenticate?

[derekcollison]

Like an alias or friendly name you mean?

[Kinrany]

Exactly. So that the user connected to it can always check that they're using the right token.

Perhaps allow specifying the username when connecting too, error out with you're authenticated, but you also asked to confirm that this is user X and we cannot confirm that.

[derekcollison]

That feels like you should just go with JWTs then.. No?

[derekcollison]

They use nkeys for signing of course but have a public declaration of who the user is etc and what they are allowed to do..

[Kinrany]

Hmm. Maybe! But setting up JWT generation seems more complex. Neither nats nor nk do it out of the box, right? I assume it's about as simple as writing a JSON blob and then signing it with nk, but I haven't tried.

[Kinrany]

Aside, there's nk -pre <vanity>. It is quite nice and can be used in a similar way. But it can't generate keys for longer usernames, and it can't generate keys that start with some characters at all.

[derekcollison]

The NATS cli from main does make this quite a bit easier. @ripienaar can give some guidance here.

[ripienaar]

Very easy now

https://github.com/nats-io/natscli/blob/main/AUTH.md

Here is a short video of a early version of this in action

https://youtu.be/ZVLIq0NrN6E?feature=shared